Shufti and AML Certification Centre logosWebinarThe FRAML Convergence: Unifying Fraud and AML MonitoringRegister Now WebinarThe FRAML Convergence: Unifying Fraud and AML MonitoringRegister Now The FRAML Convergence — Unifying Fraud and AML MonitoringRegister Shufti and ICA 25 Years logosWebinarFinancial inclusion and AML/CFT: Managing access and risk in practiceRegister Now WebinarFinancial inclusion and AML/CFT: Managing access and risk in practiceRegister Now Financial inclusion and AML/CFT — Managing access and riskRegister Shufti and Finance Magnates logosWebinarTransaction Monitoring & KYC: Cutting False Positives Without Missing Real FraudRegister Now WebinarTransaction Monitoring & KYC: Cutting False Positives Without Missing Real FraudRegister Now Transaction Monitoring & KYC — Cutting False PositivesRegister WebinarPix Fraud 2026: Are Your Fraud Controls Ready for the Next Generation of Instant Payment Scams?Explore Now WebinarPix Fraud 2026: Are Your Fraud Controls Ready for the Next Generation of Instant Payment Scams?Explore Now Pix Fraud 2026 — Are Your Fraud Controls Ready?Explore Gavel on AMLR rule bookAMLR applies 10 July 2027. See your stack against every obligationBook a Demo AMLR applies 10 July 2027. See your stack against every obligationBook A Demo AMLR applies 10 July 2027 — see your stackBook Demo Globe with pKYC, Onboarding, Screening and Transactions labelsShufti’s Glocal PlatformGlobal Coverage. Local Depth. Full Compliance Lifecycle.Explore More Global Coverage. Local Depth. Full Compliance Lifecycle.Explore More Glocal Platform — Global Coverage. Local Depth.Explore INNOVATION DROPSUMMER
EDITION
20
26
Qualified Electronic Signature
WATCH NOW
INNOVATION DROP - Qualified Electronic SignatureWatch Now Innovation Drop — Qualified Electronic SignatureWatch
INNOVATION DROPSUMMER
EDITION
20
26
Transaction Trust Monitoring
WATCH NOW
INNOVATION DROP - Transaction Trust MonitoringWatch Now Innovation Drop — Transaction Trust MonitoringWatch
INNOVATION DROPSUMMER
EDITION
20
26
Travel Rule Compliance
WATCH NOW
INNOVATION DROP - Travel Rule ComplianceWatch Now Innovation Drop — Travel Rule ComplianceWatch
Datos Insights 2026 Impact Awards badgeDatos Insights 2026 Impact AwardsShufti Named Best KYC/KYB Innovation SolutionExplore The Win Shufti Named Best KYC/KYB Innovation SolutionExplore The Win Shufti Named Best KYC/KYB Innovation SolutionExplore Liminal 2026 KYC IndexShufti: A top vendor for product executionRead The PR Shufti: A top vendor for product executionRead The PR Liminal 2026 KYC Index — Shufti: A top vendor for product executionRead PR Gavel on AMLR rule bookAMLR Applies 10 July 2027. Don't Wait for the Deadline to Find the GapsBook Consultation AMLR Applies 10 July 2027. Don't Wait for the Deadline to Find the GapsBook Consultation AMLR Applies 10 July 2027 — Find the GapsConsult Bank card and cashBank Account Verification: Get Secure Payouts with Confirmed OwnershipSee How It Works Bank Account Verification: Get Secure Payouts with Confirmed OwnershipSee How It Works Bank Account Verification — Secure PayoutsSee How Geo Compliance Ties Verified Location to a Verified IdentityBook A Demo Geo Compliance Ties Verified Location to a Verified IdentityBook A Demo Geo Compliance — Verified Location, Verified IdentityBook Demo Journey Builder dot gridConfigure Verification Flows as Per Your Needs with Journey BuilderSee How It Works Configure Verification Flows as Per Your Needs with Journey BuilderSee How It Works Journey Builder — Configure Verification FlowsSee How Shufti MCP toggle with ChatGPT and ClaudeShufti MCP: Verification Tools, Ready to Use Inside Claude or ChatGPTExplore Agent Shufti MCP: Verification Tools, Ready to Use Inside Claude or ChatGPTExplore Agent Shufti MCP — Verification Tools Inside Claude or ChatGPTExplore

Scale Identity Verification and KYC Operations in Albania

Run online identity verification in Albania through Letërnjoftim and passport chip checks plus 10,000+ foreign ID document types, run KYB on QKB-registered businesses and their owners, and monitor transactions and sanctions lists. One platform runs compliance and fraud prevention across the full customer lifecycle for Bank of Albania- and AMF-supervised firms.

Banner Image for Albania
Trusted by 2000+ businesses that make identity decisions at scale
cashew gemone HERO Gaming Bitget IronFX PENN National Rakuten Witzeal Noteris banxy

Operational Performance for Albania KYC

Our Numbers Speak Volumes

99.40%

Pass
Rates

Under 5 secs

IDV
Verification

100%

Omni-format
Document Recognition

THE ALBANIA VERIFICATION GAP

Albania IDV/KYC Challenges

Remote Onboarding Comes With Strict Conditions

Remote Onboarding Comes With Strict Conditions

Instruction No. 1/2025 allows electronic identification only on an official biometric ID document with a photograph, and excludes non-residents under 18 or holding documents from high-risk countries. Shufti checks each condition inside the flow, so ineligible applicants move to another verification route.

Keeping Customer Risk Current Requires Continuous Monitoring

Keeping Customer Risk Current Requires Continuous Monitoring

Albanian law requires continuous monitoring of every business relationship and customer files that stay valid and up to date, not a one-off check at onboarding. Shufti checks transactions against each customer's profile, refreshes sanctions and PEP data every 15 minutes and flags ownership changes.

Beneficial Ownership Records Can Trail Real Changes

Beneficial Ownership Records Can Trail Real Changes

Ownership changes can take up to three months to reach the register of beneficial owners, and firms must act on any gap between the register and their records. Shufti maps ownership through every corporate layer and flags each mismatch for review.

Thin Case Files Weaken 72-Hour Suspicious Activity Reports

Thin Case Files Weaken 72-Hour Suspicious Activity Reports

Firms have no more than 72 hours to report a suspicion to the Financial Intelligence Agency, which leaves no time to rebuild a case from scattered systems. Shufti's case management keeps the identity, screening and transaction evidence behind every suspicious activity report (RAD) in one file.

Documents and Languages

Individual Documents Shufti Verifies in Albania

Shufti verifies 8 Albanian identity documents plus passports and ID cards from other countries. The cards below cover the core documents Albanian onboarding relies on, with the full list on the supported documents page.

View All Supported Documents

Letërnjoftim (Albanian Electronic ID Card)

Every citizen aged 16 or over can hold the Letërnjoftim, issued under Law No. 8952/2002 and produced by the state-owned IdentiTek. Shufti reads its chip through NFC, runs forensic checks on the card and matches a live selfie to the photo with liveness.

Letërnjoftim (Albanian Electronic ID Card)

Leje Qëndrimi (Residence Permit)

Foreign nationals living in Albania hold a biometric residence permit under Law No. 79/2021 on foreigners, applied for through e-Albania and collected from the local migration office. Shufti verifies the card and confirms the holder with a liveness-checked selfie.

Leje Qëndrimi (Residence Permit)

Albanian Passport

The biometric passport serves Albanians abroad and customers without a current ID card. Shufti reads the chip and runs nine forensic detection layers, from MRZ checksum validation to hologram analysis, so a cloned or altered passport fails before onboarding.

Albanian Passport

Foreign Passports and National ID Cards

Shufti actively processes 10,000+ ID document types from 240+ countries and territories, and its zero-shot AI learns new document formats in minutes. Foreign workers, investors and visiting non-residents onboard this way, alongside an Albanian residence permit where they hold one.

Foreign Passports and National ID Cards

Albanian Driving Licence (Leje Drejtimi)

The General Directorate of Road Transport Services (DPSHTRR) issues driving licences. Shufti checks each licence for authenticity, expiry and a facial match, which helps delivery, ride-hailing and car-rental platforms vet drivers and gives lenders a second identity document.

Albanian Driving Licence (Leje Drejtimi)

Proof of Address

Albanian customers usually prove their address with an OSHEE electricity bill, a water utility bill, a bank statement or a lease agreement. Shufti reads each one and matches the name and address to the verified identity in the same step.

Proof of Address
Letërnjoftim (Albanian Electronic ID Card) Leje Qëndrimi (Residence Permit) Albanian Passport Foreign Passports and National ID Cards Albanian Driving Licence (Leje Drejtimi) Proof of Address Letërnjoftim (Albanian Electronic ID Card)
QKB Commercial Register Extract Founding Act and Statute Sector Licences and Approvals Business Address Proof QKB Commercial Register Extract

Entity Identity

QKB Commercial Register Extract

Companies register with the National Business Center (QKB) under Law No. 9723/2007 on business registration, and QKB issues register extracts in written or electronic form. Shufti verifies the extract and checks name, NUIS, legal form and administrators against live registry data.

QKB Commercial Register Extract

Founding Act and Statute

Every sh.p.k. and sh.a. registers with a founding act and statute that set out capital, shareholdings and management powers. AI-OCR reads ownership, capital and signing authority from Albanian or English text and flags GAN-generated or edited pages.

Founding Act and Statute

Sector Licences and Approvals

The Bank of Albania licenses banks, exchange offices and payment institutions, AMF licenses investment firms, insurers and DLT market participants, and AMLF licenses gaming operators. Shufti reads each licence and confirms that it matches the company's QKB record.

Sector Licences and Approvals

Business Address Proof

Companies prove their premises with a lease, an OSHEE bill in the company name or a registered-office agreement. Shufti cross-checks each document against the seat recorded with QKB, so a virtual or borrowed address stands out.

Business Address Proof

Tax Identity

NUIS (Numri Unik i Identifikimit të Subjektit)

QKB generates the NUIS when a business registers under Article 60 of Law No. 9723/2007, and the General Directorate of Taxation uses the same number, also called NIPT, as the tax ID. Shufti extracts it from every document and matches it to the QKB record.

NUIS (Numri Unik i Identifikimit të Subjektit)

Personal Number (Numri Personal)

Every Albanian citizen carries a unique personal number, printed on the Letërnjoftim and used for tax purposes. Article 5 of Law No. 9917/2008 requires firms to record it, and Shufti extracts it and checks it across every document a customer submits.

Personal Number (Numri Personal)

Foreign Tax Registrations and FATCA/CRS Self-Certification

Foreign parent companies and shareholders are verified with their home-country tax registrations. Shufti gathers FATCA and CRS self-certifications in the same due diligence form, so tax residency is settled before the account opens.

Foreign Tax Registrations and FATCA/CRS Self-Certification
NUIS (Numri Unik i Identifikimit të Subjektit) Personal Number (Numri Personal) Foreign Tax Registrations and FATCA/CRS Self-Certification NUIS (Numri Unik i Identifikimit të Subjektit)
Register of Beneficial Owners Shareholder Register and Ownership Chart Administrators, Directors and Authorised Signatories Register of Beneficial Owners

Ownership and Control

Register of Beneficial Owners

QKB keeps the register of beneficial owners under Law No. 112/2020, and Instruction No. 1/2025 requires financial firms to check their own ownership data against it. Shufti extracts every declared owner, compares the entry with the statute and shareholder records, and screens each person.

Register of Beneficial Owners

Shareholder Register and Ownership Chart

Article 4/1 of Law No. 9917/2008 requires firms to identify the beneficial owner and understand the customer's ownership and control structure. Shufti traces each holding through intermediate companies and checks every owner it finds against sanctions, PEP and adverse media lists.

Shareholder Register and Ownership Chart

Administrators, Directors and Authorised Signatories

The same article requires firms to confirm that anyone acting for a company is authorised to do so and to verify that person's identity. Shufti verifies each administrator and signatory, screens them and alerts the case owner when the QKB record shows a management change.

Administrators, Directors and Authorised Signatories

Languages We Cover

Albanian, English and Foreign Document Parsing

Albanian documents use the 36-letter Albanian alphabet, with characters such as ç and ë, while foreign customers bring documents in other scripts. Shufti's OCR reads 150+ languages and scripts, including Albanian at 98.67% accuracy, and averages 93% accuracy against Google Vision's 78.4% in its published benchmark. Zero-shot document intelligence extracts data from layouts it has never seen, on first sight, without waiting for a template.

Albanian, English and Foreign Document Parsing

Albanian Name Matching

Albanian names often lose ç and ë in foreign systems, and spellings shift between documents issued at home and abroad. Native phonetic models for 80+ languages match these variants in sanctions and PEP screening, so a dropped diacritic never hides a listed person.

Albanian Name Matching

Cross-Document Consistency Checks

Names, dates of birth and personal numbers are reconciled across the Letërnjoftim, passport, residence permit, QKB extract, NUIS records and the register of beneficial owners. Shufti flags every mismatch for review, so a changed date of birth or a swapped surname cannot pass unnoticed.

Cross-Document Consistency Checks
Albanian, English and Foreign Document Parsing Albanian Name Matching Cross-Document Consistency Checks Albanian, English and Foreign Document Parsing

Independent Validation

Shufti's Recognition Across Independent Evaluations

Liminal

Ranked Exceptional in the Liminal Index 2026 for age estimation

View Reportarrow-icon
Gartner

Differentiated by Gartner on document diversity and country coverage

Read morearrow-icon
iBeta

Certified at iBeta Level 3 PAD with 0% APCER

Read Blogarrow-icon
KuppingerCole

Broadest global reach in the 2025 KuppingerCole Extended IDV report

Download Reportarrow-icon
Homeland Security

Ranked Top 5 in the DHS RIVR 2025 for identity validation

Read Blogarrow-icon
Liminal

Top Vendor for Product Execution in the Liminal Index for KYC 2026

View Reportarrow-icon
Liminal

Ranked Exceptional for age verification by Liminal Index 2026

View Reportarrow-icon
G2

Recognised as a Leader in G2 Fall 2026 reports

Read Morearrow-icon

Regulatory Update

Every Verification Route Albanian Firms Rely On, in One Platform

Article 6 of Law No. 9917/2008 requires specific procedures for customers onboarded without physical presence, and Instruction No. 1/2025 ties electronic identification to an official biometric ID document. Shufti supports Letërnjoftim chip and biometric checks, plus passport chip, document, registry and video routes for non-residents and customers without a Letërnjoftim.

Fraud Prevention Across the Albanian Customer Journey

Reduce fraud losses and protect customer trust across onboarding, account access, and payments. Shufti connects identity, behavioral, device, network, and transaction intelligence to help Albanian businesses act on risk while keeping legitimate customers moving.

  • 01

    Account Takeover and Recovery Abuse

    Stop attackers who take over bank and wallet accounts with swapped SIM cards, phished passwords or stolen one-time codes. Account takeover prevention requests a liveness-checked selfie at recovery and on risky logins, while device and behavioral signals expose sessions the real owner never started.

  • 02

    Social Engineering and Manipulated Payments

    Protect customers persuaded to send money by callers posing as bank staff, investment advisers or relatives in trouble. Behavioral biometrics detects hesitation and remote access tools, active-call detection flags coached sessions, and transaction monitoring holds authorised push payment (APP) scam transfers that break a customer's normal pattern.

  • 03

    Device Spoofing and Automated Attacks

    Block scripted sign-ups and emulator farms that open accounts in bulk for mule networks and bonus abuse. Device fingerprinting gives each session a device profile, detects emulators, rooted phones and location spoofing, and recognises a handset that returns under a new name and SIM card.

  • 04

    Connected Fraud Rings and Repeat Offenders

    Stop offboarded fraudsters from returning with fresh identities and new phone numbers. Fraud network detection connects identities, devices, numbers and accounts, and Shufti's cross-company fraud intelligence flags applicants already linked to confirmed fraud elsewhere in its network before they reach your approval queue.

  • 05

    Synthetic Identities and Fabricated Documents

    Reject applicants built from a genuine personal number, a borrowed SIM card and an address nobody lives at. Email and phone enrichment tests whether contact details have a real history, and zero-shot document intelligence catches forged foreign documents and edited company papers the first time they appear.

  • 06

    Deepfakes and Camera Injection

    Protect selfie onboarding and video identification from face swaps, replayed recordings and virtual cameras. Deepfake detection inspects the camera feed for injection attacks, and iBeta Level 3 liveness confirms a real person is present before the face is matched to the Letërnjoftim chip, passport chip or document photo.

  • 07

    Money Mules and Rapid Fund Movement

    Find the mule accounts that receive scam proceeds and move them on within minutes. Money mule detection follows fast in-and-out flows, many-to-one transfers and sudden shifts in account behavior, and routes flagged accounts to investigators while the funds can still be held.

  • 08

    Fraudulent Businesses and Concealed Ownership

    Keep shell companies and front businesses off your merchant and corporate books. Shufti checks the QKB record, NUIS and sector licences, maps every beneficial owner through each corporate layer, and screens administrators and owners against sanctions and PEP lists before a merchant account goes live.

Governance & Controls

Audit-Ready Decisions, Lower Operational Drag

Fewer Avoidable Re-submissions

Capture guidance for Letërnjoftim chip reads, selfies, passports and Albanian-language company papers cuts failed attempts before they reach your review queue.

Fewer Avoidable Re-submissions

Cleaner Audit Trails

Shufti's case management records sources, results, timestamps, evidence, analyst notes and decision history, packaged as report-ready bundles for RAD reports to the Financial Intelligence Agency.

Cleaner Audit Trails

One Workflow, One Back Office

Unify KYC, KYB, AML screening and transaction monitoring in one case file. Perpetual KYC/KYB tracks ownership, administrator and transaction changes across the full compliance lifecycle.

One Workflow, One Back Office

Letërnjoftim and Residence Permit-First Flow Design

Residents verify through Letërnjoftim chip or residence permit biometric checks first, while non-residents move to passport chip verification in the same flow.

Letërnjoftim and Residence Permit-First Flow Design

Shufti's IDV/KYC Solutions for Albania

KYC Solutions

A know your customer service in Albania has to cover citizens at home and abroad, foreign residents and visiting non-residents, most of them holding a Letërnjoftim, a residence permit or a passport. One Shufti flow routes each by risk, so nobody faces checks they don't need.

Explore More
Face Verification

Face Verification

Remote onboarding needs specific procedures under Albanian law, so a document alone is not enough. Shufti matches a live selfie to the Letërnjoftim, chip or document photo with iBeta Level 3 liveness, blocking masks, replays and deepfakes while 99.5% of genuine customers pass first time.

.
Age Verification

Age Verification

Gaming operators and age-restricted services must keep minors out, and many young customers hold no ID card before 16. Shufti estimates age from a selfie in under 5 seconds and falls back to the date of birth on the Letërnjoftim or passport when needed.

.
Bank Account Verification

Bank Account Verification

Loan payouts, refunds and withdrawals go astray when an IBAN or holder name is wrong. Shufti validates Albanian IBANs and their checksum and confirms the account holder's name in real time before money moves, so funds reach the verified customer.

.
Address Verification

Address Verification

OSHEE bills, bank statements and leases arrive as photos, scans and PDFs of uneven quality. Shufti reads each one with layout-aware extraction and fuzzy matching, reaching a 99.3% pass rate, so genuine addresses clear without anyone retyping them.

.
Document Verification

Document Verification

Letërnjoftim cards, residence permits, passports and company papers arrive in every format and quality. Shufti authenticates each within seconds and catches screenshots, replayed images, synthetic PVC cards and print-and-scan copies, so forgeries stop at the first check.

.
Identity Verification

Identity Verification

Separate tools for documents, selfies, chip reads and addresses scatter one customer across several records. Shufti runs biometric, NFC, document and address checks in one API session, giving compliance teams one decision and one audit trail per customer.

.

KYB Solutions

Business verification in Albania means reconciling the QKB extract, the NUIS and the owners declared to the register of beneficial owners, often across several corporate layers. Shufti's live registry calls and owner mapping assemble those records into a single review.

Explore More
Business Verification

Business Verification

Onboarding an Albanian company means confirming its QKB record, NUIS, signatories and everyone who owns or controls 25% or more. Shufti's live registry call pulls that picture together in one check, putting corporate onboarding under two minutes.

.
Enhanced Due Diligence

Enhanced Due Diligence

Article 8 of Law No. 9917/2008 requires senior management approval, source of funds and wealth checks and enhanced monitoring for PEPs, who keep that status for up to three years after leaving office. Shufti's due diligence forms branch by risk and send UBO verification links.

.

AML Screening

A customer who is clean at onboarding can land on a list next week. Shufti's perpetual KYC rescreens customers against 4,000+ watchlists, including Albania's national list of designated persons and UN Security Council lists, refreshing every 15 minutes and keeping every alert in one case file.

Explore More
Business AML Screening

Business AML Screening

Risk in a company often sits with its owners and administrators. Shufti screens entities, administrators and beneficial owners against Albania's list of designated persons and UN restrictive measures, and perpetual KYB rescreens them whenever the QKB record or declared ownership changes.

.
Transaction Monitoring

Transaction Monitoring

Cash transactions of 1,000,000 lek or more go to the Financial Intelligence Agency by the next working day, so deposits split below that line stand out. Shufti's library of 500+ pre-built rules covering structuring, smurfing, and mule activity cuts false positives by 60%.

.
Travel Rule

Travel Rule

Article 10 of Law No. 9917/2008 extends the duty to send originator and beneficiary details with each transfer to virtual asset service providers. Shufti's Travel Rule solution exchanges IVMS101 data through one integration with major networks and confirms ownership of unhosted wallets.

.
AI Compliance Co-Pilot

AI Compliance Co-Pilot

One common name can return 140+ screening hits. Shufti's AI Compliance Co-Pilot reviews every hit and gives a confidence score out of 100 with a written reason, while your MLRO keeps the final call.

.
REGULATORY ALIGNMENT

Built To Fit Albania's Compliance Landscape

AML in Albania rests on Law No. 9917/2008 and the Financial Intelligence Agency, while the Bank of Albania, AMF, AMLF and other authorities add rules for the firms they oversee. Shufti maps its KYC, KYB, AML screening and transaction monitoring controls to every regime below, so one platform covers each licence your group holds.

Law No. 9917/2008 on the Prevention of Money Laundering and Financing of Terrorism

Law No. 9917/2008 on the Prevention of Money Laundering and Financing of Terrorism

Last amended by Law No. 37/2026 of April 2026, the law sets the core duties of every reporting entity, while a replacement law remains in draft. Article 4/1 covers due diligence and monitoring, Article 6 remote customers and Article 16 record retention.

Bank of Albania (Banka e Shqipërisë, BSH)

Bank of Albania (Banka e Shqipërisë, BSH)

The Bank of Albania licenses and supervises banks, non-bank financial institutions, payment and e-money institutions, exchange offices and savings and loan associations. Its Regulation No. 44/2009 on AML/CFT, last amended in April 2026, requires written procedures for business conducted without the customer's physical presence.

Financial Intelligence Agency (AIF)

Financial Intelligence Agency (AIF)

The Financial Intelligence Agency is Albania's FIU, reporting to the Minister of Finance, and took its current name under Law No. 62/2023. It receives suspicious activity and cash transaction reports electronically, issues AML instructions with the ministry and supervises several non-financial sectors directly.

Instruction No. 1/2025 on AML Procedures for Financial Entities

Instruction No. 1/2025 on AML Procedures for Financial Entities

Issued by the Minister of Finance in January 2025, the instruction sets AML methods for entities engaged in financial activities. Article 6 sets the conditions for electronic identification, Article 13 requires owner data to be checked against the beneficial ownership register and Article 31 sets the RAD reporting form.

Albanian Financial Supervisory Authority (AMF)

Albanian Financial Supervisory Authority (AMF)

AMF supervises securities markets, insurers, private pension funds and collective investment undertakings. Under Law No. 66/2020 on financial markets based on distributed ledger technology, it licenses virtual asset activity with the National Agency for Information Society, and licence holders must apply the AML law.

Law No. 112/2020 on the Register of Beneficial Owners

Law No. 112/2020 on the Register of Beneficial Owners

The register covers anyone who owns 25% or more of an entity, directly or indirectly. Article 5 gives entities 90 calendar days to register a change, and Article 13 sets fines of up to 600,000 lek for missing declarations and suspends QKB services until the fine is paid.

National Business Center (QKB)

National Business Center (QKB)

QKB runs the commercial register under Law No. 131/2015 and Law No. 9723/2007 on business registration, and it also administers the register of beneficial owners. Its registry data is the official record of a company's legal form, administrators, NUIS and registered seat for any entity check.

Law No. 157/2013 on Measures Against Terrorism Financing

Law No. 157/2013 on Measures Against Terrorism Financing

The Council of Ministers approves Albania's national list of designated persons on proposals from the foreign and finance ministers and publishes it in the Official Gazette. Under Article 10/1, freezing applies as soon as the UN announces a designation, without waiting for a national decision.

Law No. 72/2019 on International Restrictive Measures

Law No. 72/2019 on International Restrictive Measures

Amended by Law No. 101/2023, the law gives effect to UN Security Council restrictive measures in Albania. The Ministry for Europe and Foreign Affairs publishes the resolutions and keeps a registry of measures, and Article 8 requires immediate freezing without waiting for national implementing acts.

Gambling Supervisory Authority (AMLF)

Gambling Supervisory Authority (AMLF)

AMLF licenses and supervises games of chance under Law No. 155/2015, whose latest amendment, Law No. 18/2024, returned sports betting in online form only. Casinos and other gaming operators are reporting entities under Law No. 9917/2008 and apply due diligence on transactions from 100,000 lek.

Electronic and Postal Communications Authority (AKEP)

Electronic and Postal Communications Authority (AKEP)

AKEP regulates electronic communications under Law No. 54/2024, which replaced Law No. 9918/2008. Article 155 requires operators to register every user before activating a subscription or prepaid card, and lets AKEP set the identification data required, including electronic or biometric elements.

National Cyber Security Authority (AKSK)

National Cyber Security Authority (AKSK)

AKSK oversees cyber security under Law No. 25/2024 and trust services under Law No. 51/2026 on electronic identification, trust services and the digital identity wallet, which replaced Law No. 107/2015. It accredits trust service providers and publishes the national trusted list of qualified services.

IdentiTek

IdentiTek

Created by Council of Ministers Decision No. 80 of 2023 and attached to the Ministry of Interior, IdentiTek produces Albania's biometric ID cards, passports and residence permits. It personalises documents to ICAO standards, and Albania's ICAO Public Key Directory membership covers its biometric passports and electronic ID cards.

MONEYVAL Evaluation of Albania

MONEYVAL Evaluation of Albania

FATF removed Albania from its list of jurisdictions under increased monitoring in October 2023. MONEYVAL held its on-site visit in Tirana in April 2026, with the report due at its December 2026 plenary, and the Prime Minister chairs the national AML coordination committee.

Albania Data Residency and Deployment

Law No. 124/2024 lets personal data leave Albania only where the destination offers adequate protection or approved safeguards are in place. Shufti offers on-premises deployment, with any other hosting location and transfer arrangement set in the agreement, so each data flow has a documented legal basis.

Personal Data Protection Law (Law No. 124/2024)

Adopted in December 2024 to replace Law No. 9887/2008, the law treats biometric data as sensitive and requires breach notice to the Information and Data Protection Commissioner within 72 hours. Shufti protects identity and biometric data with encryption, role-based access controls and configurable retention.

Bank of Albania Outsourcing and Operational Risk Rules

Regulation No. 51/2024 requires banks, payment and e-money institutions to assess outsourcing risk before and during a contract and to monitor outsourced services. Shufti discloses its processing locations, signs a data processing agreement and supplies the audit logs supervisors ask for.

Retention Controls

Article 16 of Law No. 9917/2008 requires records to be kept five years after a relationship ends, and authorities can extend that by five more. Shufti configures retention per client and licence, treats legal minimums as floors rather than deletion dates and supports legal holds.

Encryption and Security

Shufti encrypts personal and financial data in transit and at rest, enforces role-based access and logs every action. ISO 27001:2022 and SOC 2 Type 2 reports support the vendor assessments that banks, payment institutions and insurers complete before onboarding a provider.

Automated Decisions and Biometric Data

Article 20 of Law No. 124/2024 gives people the right to human intervention in decisions based solely on automated processing, profiling included. Shufti exposes verification results and supporting details through the API and back office, so support teams can explain outcomes and escalate disputed results.

Scope of Our Role

Shufti processes personal data as a processor under Law No. 124/2024 and acts only on your instructions, while your firm remains the controller. Any activity where Shufti acts as an independent controller is identified in its privacy notice.

Data Residency and Privacy Controls in Albania

BUILT FOR COMPLIANCE TEAMS

Albania AML Sources That Strengthen Decisions

Turn Albania Verification Requirements into a Smoother Customer Journey

Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.

INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.

Certified to Global Standards

PROVEN WORKFLOWS

Identity Verification Built Around Your Industry in Albania

Open Accounts Remotely Under Albania's Non-⁠Face-⁠To-⁠Face Rules

Banks follow Bank of Albania Regulation No. 44/2009 and the specific procedures Albanian law requires for customers who are not physically present. Shufti combines Letërnjoftim chip reads, liveness and passport checks in one flow, then screens every customer and monitors every account from the first transaction.

Frequently Asked Questions

Does Shufti support the Letërnjoftim, and what happens when customers cannot use it?

Yes. Shufti reads the Letërnjoftim chip through NFC, checks the card for tampering and pairs it with a liveness-checked selfie. Customers without one, such as foreign residents or visitors, switch to residence permit or passport verification in the same flow.

Is scanning a Letërnjoftim enough, or should verification include its chip?

A scan leaves room for edited or counterfeit cards, and Albanian law asks for specific procedures for customers who are not present. Reading the chip confirms the issuer signed the data, and a live selfie matched to the chip photo proves the holder is present.

Can Shufti verify foreign documents or identity formats it has not encountered before?

Yes. Shufti's zero-shot AI reads layouts it has never seen without waiting for a new template. A new foreign ID card, passport series or residence document is extracted and checked for tampering the first time it enters your onboarding flow.

How does Shufti OCR compare with Google OCR for Albanian identity documents?

Generic OCR often drops Albanian characters such as ç and ë, while Shufti reads Albanian text at 98.67% accuracy. Across the languages in Shufti's published benchmark against Google Vision, it averages 93% accuracy to Google's 78.4%, so expat and foreign director records arrive complete too.

How does Shufti verify ownership when an Albanian company has several corporate layers?

Shufti pulls the QKB record for each company in the chain, maps holdings through every layer and identifies everyone holding 25% or more or controlling the company by other means. Each owner is compared with the register of beneficial owners and screened before approval.

Does Shufti's ongoing monitoring cover more than sanctions screening?

Yes. Article 4/1 of Law No. 9917/2008 requires continuous monitoring of the business relationship, including analysis of transactions against the customer's profile and source of funds. Shufti monitors transactions, rescreens customers and beneficial owners, and flags ownership or administrator changes on the QKB record.

How does Shufti keep screening current and handle Albanian name variations?

Watchlists, including Albania's national list of designated persons and UN restrictive measures, refresh every 15 minutes. Native phonetic models match Albanian names written with or without ç and ë and spellings used abroad, so a respelled name still leads to the right listed person.

Can we control where our data is hosted or run verification inside our own infrastructure?

Yes. Run Shufti on-premises inside your own infrastructure, air-gapped if required, with any other hosting location agreed in the contract. Keeping data in your own systems also limits the cross-border transfers that Law No. 124/2024 allows only with adequate protection or safeguards.

What controls help us protect identity and biometric data?

Shufti encrypts data in transit and at rest, limits access by role and logs every action, backed by ISO 27001:2022 and SOC 2 Type 2. Biometric data, which Law No. 124/2024 treats as sensitive, stays under the same controls with the retention periods you set.

Can we configure different retention periods for different Albanian licences?

Yes. Retention is set per client, licence and record type, so AML records stay at least five years after a relationship ends while subscriber, gaming or tax records follow their own schedules. A legal hold stops deletion of any record tied to an investigation.

What does Shufti provide when our compliance team needs to prepare a RAD report for the Financial Intelligence Agency?

Shufti's case file holds the verified identity, screening hits, transaction history, analyst notes and decision trail, exported as a report-ready bundle. Your compliance officer can report within the 72 hours Law No. 9917/2008 allows, without rebuilding the case from separate systems.

Can we add verification checks without rebuilding our onboarding journey?

Yes. The AI Journey Builder adds or reorders checks such as Letërnjoftim NFC, passport chip reads, address verification and AML screening by product, customer type and risk tier. Changes go live without new code or a new release, so compliance updates never wait on engineering.

How does Shufti make verification queries easier for our customer support team?

Every decision appears in the back office with its reason, the failed check and the captured evidence. Support staff can tell a customer whether a selfie failed liveness or a chip read was rejected, then pass disputed results to compliance in one click.

Let’s Build Trust Into Your Business

1B+Verifications Processed

240+Regions Actively Processed

99.7%Accuracy Rate

Samer Al Tamimi

CEO of Safwa Bank

Samer Al Tamimi

“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”

Trusted. Compliant. Certified

cetificate-logos cetificate-logos cetificate-logos cetificate-logos

Explore Shufti For Your Business

Get a personalised demo from our experts.

    Which products would you like to check out?

    VideoIdent

    Address Verification

    eIDV (Docless)

    KYB

    AML Screening

    Fraud Prevention

    Face and ID Verification

    Age Verification

    Others

    What is your expected yearly verification volume?

    1 to 1,000

    1,001 to 5,000

    5,001 to 20,000

    20,001 to 50,000

    50,001 to 100,000

    100,001 to 1,000,000

    1,000,000+

    Valid Invalid number

    By clicking Submit, you accept our Privacy Policy and consent to marketing communications.

    PROVEN PLAYBOOKS

    Explore Practical KYC & AML Resources

    Read More
    Cover of What Is SEPA? Schemes, Countries and Regulations

    17 September, 2026

    What Is SEPA? Schemes, Countries and Regulations

    SEPA now spans 41 countries and territories, including EU candidate countries added since 2025. Covers its payment schemes, instant payment rules and fraud controls.

    Knowledge Base

    Read More
    Read More
    Cover of State of Global AML Compliance 2025 FATF Data Insight

    18 December, 2025

    State of Global AML Compliance 2025 FATF Data Insight

    AML laws read strongly on paper while enforcement lags behind. A data-led analysis of FATF findings, the gap between rules and results, and where RegTech closes it.

    Report

    Read More
    Read More
    Cover of Identity Fraud Report 2026

    21 August, 2026

    Identity Fraud Report 2026

    Identity fraud hit 22.49% of crypto verifications in H1 2026. Shufti's report breaks down AI document fraud and linked fraud networks across 11 named sectors of risk.

    Report

    Read More